Privacy Policy

1. What Information Do We Collect?

Personal Information You Disclose to Us

The use of Viral Lab is generally possible without providing extensive personal data. If personal data (such as email addresses or social media usernames) is collected, this is done on a voluntary basis whenever possible. This data will not be disclosed to third parties without your explicit consent.

Account Information: When you create an account using Apple ID, Google Sign-In, or anonymous authentication, we may collect:

• Authentication tokens from third-party sign-in providers
• Device identifiers for anonymous authentication
• Optional profile information (TikTok username, Instagram username)
• Timezone and locale information

Onboarding Data: During the onboarding process, we collect:

• Content preferences (topics, audience demographics)
• Current performance metrics (average views, growth goals)
• Primary goals and challenges as a content creator

Video Content: When you upload videos for analysis:

Information Automatically Collected

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as:

• Device Information: Device type, operating system, app version, build number
• Usage Data: Features used, videos analyzed, time spent in app, interaction patterns
• Technical Data: IP address (anonymized), browser type, language preferences, referring URLs
• Performance Data: Crash reports, error logs, diagnostic information

This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

2. How Do We Process Your Information?

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To provide and maintain the Services: Processing videos through AI analysis, generating insights, tracking your progress, and delivering personalized recommendations.
• To improve our Services: Understanding how users interact with features, identifying bugs, and optimizing performance.
• To send you service-related communications: Analysis completion notifications, important updates, security alerts.
• To send marketing communications (with consent): Product updates, feature announcements, tips for creators. You can opt out at any time.
• To ensure security: Detecting and preventing fraud, abuse, and security incidents.
• To comply with legal obligations: Responding to legal requests, enforcing our Terms of Service.

3. What Legal Bases Do We Rely On to Process Your Information?

If you are located in the EU, UK, Switzerland, or Canada, this section applies to you.

The General Data Protection Regulation (GDPR) and similar laws require us to explain the valid legal bases we rely on to process your personal information. We may rely on the following legal bases:

Consent

We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time by contacting us or adjusting your in-app settings.

Legitimate Interests

We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example:

• Improving our AI models and analysis accuracy
• Developing new features based on user behavior
• Sending users information about updates and improvements
• Supporting our marketing activities (with appropriate safeguards)

Legal Obligations

We may process your information where we believe it is necessary for compliance with our legal obligations, such as cooperating with law enforcement, exercising or defending legal rights, or complying with regulatory requirements.

Contractual Necessity

We process certain information to fulfill our contract with you (our Terms of Service), such as providing the video analysis service you requested.

4. Third-Party Services & Data Sharing

We integrate with and share limited information with the following third-party service providers to operate the Services:

Infrastructure & Authentication

• Supabase: Database hosting, authentication services, and user management. Data is stored securely in Supabase's cloud infrastructure. Supabase Privacy Policy
• Expo: App development framework and push notification services. Expo Privacy Policy
• Apple & Google: Authentication (Sign in with Apple, Google Sign-In), app distribution, and payment processing. Subject to their respective privacy policies.

AI & Analysis Services

• OpenAI: AI-powered video analysis and insights generation. Videos and metadata are processed through OpenAI's API. OpenAI does not use data sent via API to train their models. OpenAI Privacy Policy
• Anthropic (Claude): Additional AI analysis and natural language processing for generating recommendations. Anthropic Privacy Policy

We may share aggregated or pseudonymous information (including demographic information and usage statistics) for analytics purposes. We do not, however, share information that personally identifies you (such as name or email address) except as described in this Privacy Policy.

5. Do We Use Cookies and Tracking Technologies?

We may use cookies and similar tracking technologies (like local storage, session tokens, and device identifiers) to access or store information for the following purposes:

• Authentication: Maintaining your login session
• Preferences: Remembering your settings and preferences
• Analytics: Understanding how you use the app (anonymized)
• Performance: Optimizing app performance and user experience

Most mobile devices allow you to control or disable tracking through device settings. If you choose to disable certain tracking technologies, some features of the Services may not function properly.

6. AI Services & Video Processing

Important Notes:

• AI analysis may not be 100% accurate and should be used for informational purposes only.
• Videos containing sensitive, private, or confidential information should not be uploaded.
• You retain all ownership rights to your videos; we only have a temporary license to process them for analysis purposes.

7. How Long Do We Keep Your Information?

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

Retention Periods:

• Account Data: Retained as long as your account is active, plus 90 days after account deletion.
• Video Files: Deleted immediately after analysis is complete (24-48 hours maximum).
• Analysis Results: Retained while your account is active to show your history and progress.
• Usage & Analytics Data: Retained in anonymized form for up to 24 months.
• Legal & Compliance Data: Retained as required by law (typically 6-7 years for financial records).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

8. Children's Privacy

Our Services are not intended for use by children under 16 years of age. If we learn that we have collected personal information through the Services from a child under 16 without the consent of the child's parent or guardian as required by law, we will delete it immediately.

If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us at privacy@virallab.app. In certain jurisdictions, this age requirement may be higher due to local regulatory requirements.

9. What Are Your Privacy Rights?

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right:

• (i) To request access and obtain a copy of your personal information
• (ii) To request rectification or correction of inaccurate data
• (iii) To request erasure or deletion of your personal information
• (iv) To restrict the processing of your personal information
• (v) To data portability (receiving your data in a machine-readable format)
• (vi) Not to be subject to automated decision-making
• (vii) To object to the processing of your personal information

You can exercise these rights by contacting us using the contact details provided in the 'How Can You Contact Us?' section below. We will consider and act upon any request in accordance with applicable data protection laws.

Regional Rights

EEA, UK & Switzerland: If you believe we are unlawfully processing your personal information, you have the right to complain to your local data protection authority.

California (CCPA): California residents have additional rights, including the right to know what personal information we collect, the right to delete personal information, and the right to opt-out of the sale of personal information (note: we do not sell personal information).

Canada (PIPEDA): Canadian residents have the right to access and correct their personal information, and to file complaints with the Privacy Commissioner of Canada.

Withdrawing Your Consent

If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. You can withdraw your consent by:

• Contacting us at privacy@virallab.app
• Adjusting settings within the app
• Unsubscribing from marketing emails via the "unsubscribe" link

However, please note that this will not affect the lawfulness of the processing before its withdrawal, nor will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Opting Out of Marketing Communications

You can unsubscribe from our marketing and promotional communications at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Adjusting notification preferences in the app settings
• Contacting us at privacy@virallab.app

You will then be removed from the marketing lists. However, we may still communicate with you for service-related purposes (e.g., account notifications, security alerts, analysis completion updates).

Data Deletion Requests

To request deletion of your personal information:

1. Send an email to privacy@virallab.app with the subject "Data Deletion Request"
2. Include your account email or user identifier
3. We will process your request within 30 days and confirm deletion

10. Do We Make Updates to This Notice?

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this privacy notice, and the updated version will be effective as soon as it is accessible.

If we make material changes to this privacy notice, we may notify you either by:

• Prominently posting a notice of such changes in the app
• Directly sending you a notification via email or push notification

We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.

11. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, you may email us at privacy@virallab.app or contact us by post at: